include global/restrictions.conf;
	include global/wordpress.conf;

# Global restrictions configuration file.
# Designed to be included in any server {} block.
location = /favicon.ico {
	log_not_found off;
	access_log off;
}

location = /robots.txt {
	allow all;
	log_not_found off;
	access_log off;
}

# Deny all attempts to access hidden files such as .htaccess, .htpasswd, .DS_Store (Mac).
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
location ~ /\. {
	deny all;
}

# Deny access to any files with a .php extension in the uploads directory
# Works in sub-directory installs and also in multisite network
# Keep logging the requests to parse later (or to pass to firewall utilities such as fail2ban)
location ~* /(?:uploads|files)/.*\.php$ {
	deny all;
}

# WordPress single site rules.
# Designed to be included in any server {} block.
# Upstream to abstract backend connection(s) for php
upstream php {
        server unix:/tmp/php-cgi.socket;
        server 127.0.0.1:9000;
}

server {
        ## Your website name goes here.
        server_name domain.tld;
        ## Your only path reference.
        root /var/www/wordpress;
        ## This should be in your http block and if it is, it's not needed here.
        index index.php;

        location = /favicon.ico {
                log_not_found off;
                access_log off;
        }

        location = /robots.txt {
                allow all;
                log_not_found off;
                access_log off;
        }

        location / {
                # This is cool because no php is touched for static content.
                # include the "?$args" part so non-default permalinks doesn't break when using query string
                try_files $uri $uri/ /index.php?$args;
        }

        location ~ \.php$ {
                #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
                include fastcgi.conf;
                fastcgi_intercept_errors on;
                fastcgi_pass php;
                fastcgi_buffers 16 16k;
                fastcgi_buffer_size 32k;
        }

        location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
                expires max;
                log_not_found off;
        }
}

RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /(.*)\ HTTP/ [NC]
RewriteCond %{HTTPS} !=on [NC]
RewriteRule ^/?(wp-admin/|wp-login\.php) https://mysite.com%{REQUEST_URI}%{QUERY_STRING} [R=301,QSA,L]

Apply the following in the location / section in your server block:

        try_files $uri $uri/ /index.php?q=$request_uri;

XML-RPC is a remote procedure call (RPC) protocol which uses XML to encode its calls and HTTP as a transport mechanism and its functionality is turned on by default since WordPress 3.5.
XML-RPC is an API - this API gives developers and services the ability to talk to a wordpress site

Examples where XML-RPC functionality is needed:
XML-RPC functionality is primarily used for three common reasons:

1. Pingbacks/trackbacks (great for Viagra spam, DDoS attacks, and not much else)
2. Jetpack (an all-in-one solution to slowing down and/or bloating your WordPress site with third-party scripts)
3. WP mobile apps

More information on XML-RPC API for wordpress can be found: https://codex.wordpress.org/XML-RPC_WordPress_API

xml-rpc can use system.multicall - this can be used to execute multiple methods inside a single request. This allows applications to pass multiple commands with one http request.
This means that potential bots and hackers can use the system.multicall method to guess 100's or 1000's of passwords with a single http request
Hackers can attempt thousands of password attempts with just a 3-4 http request. These requests bypass security tools designed to block brute force attempts. These requests will have 1 entry per request in the log file.
NOTE: Your systems load average may increase significantly during one of these attacks. It may be a little hard to initially diagnose the issue as apache is NOT hitting max clients. Remember to investigate the access logs and see if there are lots of POST requests to XMLRPC.php!

—
NOTE: WordPress, Drupal and most content management systems support XML-RPC.
It can be used with Perl, Java, Python, C, C++, PHP and many other programming languages.

Checking apache and nginx logs for xmlrpc

 awk '/xmlrpc.php/ {REQ[$1" "$6" "$7]++}END{for (i in REQ) print REQ[i],i}' /var/log/httpd/*access*log | sort -n | tail -25

Basic configuration:

To prevent xmlrpc attacks add the following to a .htaccess
<Files "xmlrpc.php">
Order Allow,Deny
deny from all
</Files>

If you have application or plugins or you are a hosting reseller then you will want to add something similar to the code below. This code allows the wordpress IP range (current IP range, this could change) and denies potential attacks:

Apache .htaccess:

<Files "xmlrpc.php">
Order Deny,Allow
Deny from all
Allow from 192.0.64.0/18
Satisfy All
ErrorDocument 403 http://127.0.0.1/
</files>

Nginx
Deny all through nginx

         location = /xmlrpc.php {
            deny all;
            access_log off; #to prevent from filling up the access log file
            error_log off; #to prevent from filling up the error log file
        }

Allowing Wordpress IPs

         location = /xmlrpc.php {
            allow 192.0.64.0/18;
            deny all;
            access_log off; #to prevent from filling up the access log file
            error_log off; #to prevent from filling up the error log file
        }

This wordpress plugin does come with xmlrcp.php protection from brute force.
Note: This is SITE specific and will note cover system wide wordpress sites.
Jet pack: https://wordpress.org/plugins/jetpack/

##CURRENTLY INVESTIGATING ##
I believe it costs around $5 a month
This can also be used to block an attempted attack on XMLRPC


References:
https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-against-wordpress-xmlrpc.html
https://www.wordfence.com/blog/2015/10/should-you-disable-xml-rpc-on-wordpress/
http://wptavern.com/its-time-for-xml-rpc-in-wordpress-to-hit-the-road
https://www.saotn.org/huge-increase-wordpress-xmlrpc-php-post-requests/ - READ

Change the following values:

database
USER
<password>
NAME
[email protected]

# USE database;

# INSERT INTO `wp_users` (`user_login`, `user_pass`, `user_nicename`, `user_email`, `user_status`) VALUES ('USER', '<password>', 'NAME', '[email protected]', '0');

# INSERT INTO `wp_usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, (Select max(id) FROM wp_users), 'wp_capabilities', 'a:1:{s:13:"administrator";s:1:"1";}');

# INSERT INTO `wp_usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, (Select max(id) FROM wp_users), 'wp_user_level', '10');